Hi,
I have a problem to list/access share from Windows client to share hosted on samba domain member server.
I followed the instruction from
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Memberstep by step but I used sssd instead of winbind for the authentication method.
The Linux samba server is an Ubuntu server 16.04 and I successfully added this samba server to a awindows active directory domain (Windows server 2012 R2).
I login to the domain server machine as a domain admins user but II’m not able to list/access to the share when I digit in Windows Explorer \\servername I have the access denied with the request to insert the credential of a user enabled to it. Only the user mapped in /etc/samba/user.map can manage the server via the ADUC interface and list, but I’ve assigned the SeDiskOperatorPrivilege to all domain admin Group
root@SRVLNXWINTRA01:/home/data# net rpc rights list privileges SeDiskOperatorPrivilege -U "com_spoleto\adminserver"
Enter com_spoleto\adminserver's password:
SeDiskOperatorPrivilege:
COM_SPOLETO\Domain Admins
BUILTIN\Administrators
Is there anyone can help me?
Below my configuration files.
----------------------------------------------------------------------
My /etc/samba/smb.conf
# Global parameters
[global]
workgroup = COM_SPOLETO
realm = COMUNE.SPOLETO.LOCAL
server string = %h server (Samba, Ubuntu)
interfaces = lo ens32
bind interfaces only = Yes
server role = standalone server
security = ADS
map to guest = Bad User
obey pam restrictions = Yes
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
username map = /etc/samba/user.map
unix password sync = Yes
kerberos method = secrets and keytab
log file = /var/log/samba/log.%m
max log size = 1000
client signing = if_required
dns proxy = No
panic action = /usr/share/samba/panic-action %d
winbind refresh tickets = Yes
idmap config comune.spoleto.local : range = 10000-29999
idmap config comune.spoleto.local : backend = rig
idmap config * : range = 3000-7999
idmap config * : backend = tdb
map acl inherit = Yes
store dos attributes = Yes
vfs objects = acl_xattr
[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
printable = Yes
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
[share]
comment = Progetti QGIS per Lizmap
path = /home/data/share
read only = No
inherit acls = Yes
-----------------------------------------------------------------------------
My /etc/samba/user.map
!root = COM_SPOLETO\Adminserver
----------------------------------------------------------------
My /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat sss winbind
group: compat sss winbind
shadow: compat sss
gshadow: files
hosts: files dns winbind
networks: files
protocols: db files
services: db files sss winbind
ethers: db files
rpc: db files
netgroup: nis sss winbind
sudoers: files sss winbind
---------------------------------------------------------------------------------------------------------------------
My /etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = COMUNE.SPOLETO.LOCAL
[domain/COMUNE.SPOLETO.LOCAL]
id_provider = ad
access_provider = ad
# Use this if users are being logged in at /.
# This example specifies /home/DOMAIN-FQDN/user as $HOME. Use with pam_mkhomedir.so
override_homedir = /home/%d/%u
# Uncomment if the client machine hostname doesn't match the computer object on the DC.
# ad_hostname = SRVLNXINTRA01.comune.spoleto.local
# Uncomment if DNS SRV resolution is not working
# ad_server = SRVW3KDC01.comune.spoleto.local
# Uncomment if the AD domain is named differently than the Samba domain
# ad_domain = COMUNE.SPOLETO.LOCAL
# Enumeration is discouraged for performance reasons.
# enumerate = true
-------------------------------------------------------------------------------------------
My /etc/krb5.conf
[libdefaults]
default_realm = COMUNE.SPOLETO.LOCAL
ticket_lifetime = 24h #
renew_lifetime = 7d
# The following krb5.conf variables are only for MIT Kerberos.
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
dns_lookup_realm = false
dns_lookup_kdc = true
[realms]
COMUNE.SPOLETO.LOCAL = {
kdc = SRVW3KDC01.COMUNE.SPOLETO.LOCAL
master_kdc = SRVW3KDC01.COMUNE.SPOLETO.LOCAL
admin_server = SRVW3KDC01.COMUNE.SPOLETO.LOCAL
default_domain = COMUNE.SPOLETO.LOCAL
}
[domain_realm]
.comune.spoleto.local = COMUNE.SPOLETO.LOCAL
comune.spoleto.local = COMUNE.SPOLETO.LOCAL
[login]
krb4_convert = true
krb4_get_tickets = false
-------------------------------------------------------------------------------------------
Inviato da Posta per Windows 10
--
To unsubscribe from this list go to the following URL and read the
instructions:
https://lists.samba.org/mailman/options/samba
Locked
